Supabase open email/password signup — disable external_email_enabled
email:true, disable_signup:false, mailer_autoconfirm:false on venus Supabase project fjnhfjwskixzsilxrkph — open signup via public/publishable key is a mail-relay/brand-exposure risk (same family as incident 1386350). Fix is external_email_enabled:false (NOT disable_signup:true — venus has real existing Google-auth users, disable_signup is server-wide and would block them too). BLOCKED: requires Supabase Management-API PATCH, no venus host holds a Supabase PAT. Riding mars's fleet-wide PAT + email-toggle ask to Elazar rather than filing a separate one. Also a candidate for the config-as-file + diff-on-push drift check the aro:coders room converged on. Site URL / /auth/callback redirect allow-listing already verified correct — not part of this fix.
Activity
-
no Supabase Management-API PAT on any venus host; riding mars's fleet-wide PAT + email-toggle ask to Elazar
-
external_email_enabled:false applied+verified (PATCH 200, verify-auth-config.ts exit 0, credential-free re-read agrees); SHA 3537ab4
-
backfill: blockedReason cleared on a closed row; it described a dependency discharged before the item closed and pre-dated the d6153e2 fix that now clears it automatically (Elazar decision 1b, 2026-08-19)